WhatsApp gives India an ultimatum on encryption
For nearly 10 years, WhatsApp’s chat messages have been end-to-end encrypted, meaning they can’t be read by anyone except the sender and the receiver. Drawing on an open-source encryption system developed by Signal, WhatsApp began the move shortly after it was acquired by Facebook in 2014. For the most part, its encryption has been running quietly in the background ever since. There have been legal challenges, but for the world’s largest source of end-to-end encrypted communications, the past decade has been remarkably drama-free.
But WhatsApp is currently in the middle of its biggest legal challenge yet — and it’s a serious one. IT rules passed by India in 2021 require services like WhatsApp to maintain “traceability” for all messages, allowing authorities to follow forwarded messages to the “first originator” of the text.
In a Delhi High Court proceeding last Thursday, WhatsApp said it would be forced to leave the country if the court required traceability, as doing so would mean breaking end-to-end encryption. It’s a common stance for encrypted chat services generally, and WhatsApp has made this threat before — most notably in a protracted legal fight in Brazil that resulted in intermittent bans. But as the Indian government expands its powers over online speech, the threat of a full-scale ban is closer than it’s been in years.
“There is no way to predict which message a government would want to investigate in the future”
The traceability requirement has been the subject of ongoing legal challenges since it was first instituted, with the Electronic Frontier Foundation describing it as “a threat to expression and privacy online.” There are also practical concerns about how such a system would deal with screenshots or slight modifications, raising the real possibility that full compliance is simply impossible.
WhatsApp has already taken some measures to deal with harmful messages, instituting limits on message-forwarding and strengthening systems for reporting spam or misinformation. But the current system can only deal with messages as they’re reported by users, essentially blocking copies of a message one at a time.
Tracing the copies back to their source would require building a new layer of surveillance into WhatsApp. “There is no way to predict which message a government would want to investigate in the future,” the company wrote in a blog post in 2021. “To comply, messaging services would have to keep giant databases of every message you send, or add a permanent identity stamp — like a fingerprint — to private messages with friends, family, colleagues, doctors, and businesses.”
It’s not clear how the courts will respond to WhatsApp’s ultimatum, but they’ll have to take it seriously. WhatsApp is used by more than half a billion people in India — not just as a chat app, but as a doctor’s office, a campaigning tool, and the backbone of countless small businesses and service jobs. There’s no clear competitor to fill its shoes, so if the app is shut down in India, much of the digital infrastructure of the nation would simply disappear. Being forced out of the country would be bad for WhatsApp, but it would be disastrous for everyday Indians.
Reached for comment, a Meta representative emphasized WhatsApp’s central role in India’s digital economy. “We remain committed to safeguarding the privacy of our users which is integral to India’s digital growth and progress,” the company said in a statement.
WhatsApp seems likely to win this battle — but local privacy advocates are still worried about the larger war. Indian researcher Srinivas Kodali, who works with a range of open-internet projects, told me the bigger challenge will come when the Digital India bill is taken up after the election. If the BJP does well in the elections, Kodali says a stronger traceability requirement is likely to be bundled into the bill — and WhatsApp may end up fighting the same battle again in six months.